CVE-2026-1078
Received Received - Intake
Arbitrary File Write in Pega Browser Extension via Malicious Sites

Publication date: 2026-04-07

Last updated on: 2026-04-07

Assigner: Pegasystems Inc.

Description
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicious code. The vulnerability could occur if a Robot Runtime user navigates to the malicious website.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-07
Last Modified
2026-04-07
Generated
2026-06-16
AI Q&A
2026-04-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1078
EUVD
EUVD-2026-19638
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
pega robotic_automation 22.1
pega robotic_automation r25
pega browser_extension 3.1.45
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The provided information does not specify how the arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

CVE-2026-1078 is an arbitrary file-write vulnerability in the Pega Browser Extension (PBE) that affects Pega Robotic Automation versions 22.1 and R25. This vulnerability occurs when a Robot Runtime user navigates to a malicious website crafted by an attacker. The malicious website contains code that exploits the PBE, potentially allowing the attacker to write arbitrary files on the affected system.

Additionally, there is a related medium-severity vulnerability in all versions of the Pega Browser Extension that can cause unexpected behaviors such as unsolicited message boxes when users visit malicious sites.

Impact Analysis

This vulnerability can allow a malicious actor to execute arbitrary file writes on your system by tricking a Robot Runtime user into visiting a malicious website. This could lead to compromise of the automation environment, potentially allowing unauthorized modification or insertion of files, which may disrupt operations or lead to further exploitation.

The medium-severity issue may also cause unexpected behaviors such as unsolicited message boxes, which could be used for social engineering or to disrupt user workflows.

Mitigation Strategies

To mitigate the vulnerability in Pega Browser Extension (PBE) affecting Pega Robotic Automation versions 22.1 and R25, it is strongly recommended to update to PBE version 3.1.45 or later.

Additionally, users running R25 should upgrade both Robot Studio and Robot Runtime to version 25.1.13. Users on version 22.1 only need to update the PBE without upgrading Robot Studio or Robot Runtime.

Contacting Pega Support for any questions or concerns is also advised.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1078. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart